HelloTalk versions through 3.4.1 inappropriately store full‑precision GPS coordinates even when the user has chosen only a country or city for sharing. The coordinates are written to a client‑side database that other users of the app can access. This results in a confidentiality breach, exposing precise location data beyond the intended granularity and enabling tracking or profiling. The vulnerability is consistent with an encryption weakness that fails to protect sensitive data, as described by CWE‑359.

All users running HelloTalk version 3.4.1 or earlier on any supported platform are affected. The issue manifests regardless of operating system or device type, as the client side database is shared across users on the same device.

The moderate CVSS score of 5.3 indicates a medium severity scenario. Because no EPSS score is available and the flaw is not in the CISA KEV catalog, the exploitation likelihood is considered moderate. An attacker only needs to be a user of the application; with normal app activity or direct interaction with another user, the attacker can read the client‑side database and obtain another user's exact coordinates. No elevated privileges or additional exploitation steps are required.